Security notice

Use Ultra Addons for Contact Form 7? A flaw rated 9.8 can let anyone delete your site's files. Update today.

Last updated: Tuesday, November 3, 2026, 11:36 AM ETStatus: Fix released. No attacks reported. Update now.

Ultra Addons for Contact Form 7 is a WordPress plugin that adds extra features to Contact Form 7 forms, and WordPress.org shows 60,000+ active installations. On November 2, 2026, Wordfence published a critical flaw in it, CVE-2026-102435, which Wordfence rates 9.8 out of 10 and Patchstack rates 8.6. In versions up to and including 3.5.54, people with no login can delete files from your website, and Wordfence says that can "easily lead to remote code execution" if the right file is deleted, such as wp-config.php, which holds your site's settings. The CVE says it works only when the plugin's PDF Generator add-on is active and a form is set up to make PDFs. Version 3.5.55 fixes it, and it came out on October 11, three weeks before the details were published. 3.5.57 is the newest. We found no report of attacks, and CISA does not list it as exploited. If your site runs this plugin, update it to the newest version today, and check that your site's files are all still there.

What happened

The flaw. The CVE record says the plugin does not check file paths properly in versions up to and including 3.5.54, which lets attackers with no account delete files on your server. Wordfence advisory titles it "Unauthenticated PHP Object Injection to Arbitrary File Deletion." In plain words, a stranger can make your site delete files, and which files they pick is up to them. We are leaving out the technical details. (CVE record, Wordfence advisory)
It only works if PDF forms are on. The CVE record says it "requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation," and that it "can only be exploited when the PDF generator feature is enabled." Neither source says how many sites have that on, and we do not know. If you do not use PDF forms, the sources say the flaw cannot be used on your site, but still update, for the reasons below. (CVE record, Wordfence advisory)
Why deleting files is serious. Wordfence says deleting the right file, such as wp-config.php, "can easily lead to remote code execution," meaning an attacker running their own commands on your server. Patchstack describes the effect as "Attackers can delete important files and break the website." (Wordfence advisory, Patchstack)
How serious. Wordfence, which assigned the CVE number, rates it CVSS 9.8, which is 9.8 out of 10 and critical. Patchstack rates it 8.6 and calls it high priority. The NVD entry is marked "Deferred" and shows only Wordfence's score. (Wordfence advisory, Patchstack, NVD)
Affected and fixed versions. Versions up to and including 3.5.54. Wordfence and Patchstack both list 3.5.55 as the first fixed version. WordPress.org now offers 3.5.57, last updated November 1, 2026. The changelog for 3.5.55 (October 11) says "Issues reported by Wordfence have been resolved" but does not name this CVE. The 3.5.57 entry mentions "PDF filename sanitization and secure mPDF content handling." (Wordfence advisory, Patchstack, WordPress.org)
The fix came first. The CVE record's timeline says the vendor was notified on September 29 and the flaw was disclosed on November 2. WordPress.org's changelog dates 3.5.55 to October 11. A site that updated since then is already covered, so check your version. (CVE record, WordPress.org)
The dates. Wordfence's advisory and Patchstack's entry are both dated November 2, 2026, and NVD listed it the same day. (Wordfence advisory, Patchstack, NVD)
No attacks reported. Neither the CVE record, Wordfence nor Patchstack says the flaw is being exploited, and we found no report that it is. CISA KEV does not list it in its version dated October 30, 2026, which we checked directly on November 3. Patchstack says that flaws like this one are "expected to become exploited" in mass attacks. That is a warning, not a report of attacks. We found no report of a public proof of concept either, and we did not look beyond the sources below. (CVE record, Patchstack, CISA KEV)
This plugin has had other serious flaws. Wordfence's list for it also includes two flaws rated 9.8 that let anyone upload files, CVE-2026-84750 (published September 17) and CVE-2026-82901 (September 26), both for versions up to 3.5.50. This is a reason to keep it updated and says nothing about the new flaw. (Wordfence advisory)
The Pro version: not confirmed. The advisory names the free plugin on WordPress.org. We found no statement about the paid Pro version. If you use it, check that it is up to date as well. (Wordfence advisory, WordPress.org)

Who should worry

This is about WordPress websites that use the Ultra Addons for Contact Form 7 plugin, also listed on WordPress.org as "Ultimate Addons for Contact Form 7," from Themefic. If you are not sure whether your site uses it, ask your web developer or agency. Ask about this if any of these are true:

Your WordPress site uses Ultra Addons for Contact Form 7 and is on version 3.5.54 or earlier, or you do not know the version.
One of your Contact Form 7 forms sends a PDF, such as a quote, a receipt or a booking, or you are not sure.
Automatic plugin updates are off on your site, or you are not sure they are on.
An agency or developer built your forms and you do not know which plugins run them.
You run a web agency or host and look after WordPress sites for clients.

If your site does not use this plugin, this notice does not apply to you.

What to do now

Do these today.

Check if you have it. In your WordPress dashboard, open Plugins, then Installed Plugins, and look for "Ultra Addons for Contact Form 7" or "Ultimate Addons for Contact Form 7." Note the version number. If it says 3.5.55 or higher, you have the fix.
Update. Update the plugin to the newest version, which is 3.5.57 at the time of writing, after taking a backup. WordPress.org lists WordPress 6.8 and PHP 7.4 as the minimums for the newest version, so if your site is older than that, ask your developer before updating. If you also use the Pro version, update it too. (WordPress.org)
If you cannot update today, ask your developer whether the PDF Generator add-on is switched on and whether any form makes PDFs, and whether it can be switched off for now. The CVE says the flaw needs it. That is our reading of the record, not the plugin maker's advice, we have not tested it, and it will stop your PDF forms. It does not replace the update. (CVE record)
Check your files. The flaw deletes files, so ask your developer or host to check that wp-config.php and your theme and plugin files are all still there, and to look for unusual requests to your form pages in the server logs. We found no report of attacks, so this is a general check. If a file is missing or the site shows a setup screen, treat it as an emergency: do not run the setup, and call your developer or host to restore from a known-good backup. Also look for PHP files you did not add in wp-content/uploads, administrator accounts you do not recognize and plugins you did not install. If you find anything, treat the site as compromised: restore from a known-good backup, then change the WordPress admin and database passwords and the WordPress salts. This is general advice, not from the sources above.
Check your site afterwards. Submit each form, including any that makes a PDF, and confirm the email and the PDF still arrive.

What to send your developer, agency or host

Ultra Addons for Contact Form 7 (ultimate-addons-for-contact-form-7) 3.5.54 and earlier has a critical flaw, CVE-2026-102435 (CVSS 9.8 from Wordfence, 8.6 from Patchstack, published November 2, 2026): unauthenticated PHP object injection that lets anyone delete arbitrary files, such as wp-config.php, and can lead to remote code execution, but only if the PDF Generator add-on is active and a form is set up to generate PDFs. 3.5.55 (October 11, 2026) is the first fixed version and 3.5.57 is the newest. CISA does not list it as exploited and we found no report of attacks. Please tell us whether our site runs this plugin or its Pro version and which version, and whether the PDF Generator is on. If the version is 3.5.54 or earlier, please back up and update to the newest version today, confirm wp-config.php and the theme and plugin files are intact, check wp-content/uploads for PHP files nobody added, and look for new administrator accounts. If anything looks wrong, please treat the site as compromised, restore a known-good backup and change the admin and database passwords and the WordPress salts, and tell us what you find. Sources: the Wordfence advisory, the CVE record, Patchstack, WordPress.org.

Common questions

Has my site been hacked?

This notice does not mean your site has been hacked. It means a critical flaw has been published, a fix has been out since October 11 and we found no report of attacks.

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your home page from the outside, the way a browser sees it. We cannot see which plugins your site runs or which versions they are on, so if our scan does not warn you about this plugin, that does not mean you are safe. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

Which version do I need?

Wordfence and Patchstack say 3.5.55 or newer. The newest on WordPress.org is 3.5.57. Take the newest. (Wordfence advisory, Patchstack, WordPress.org)

Is it being exploited?

We found no report that it is, and CISA does not list it. The details have been public since November 2, so do not wait. (Patchstack, CISA KEV)

I do not use PDF forms. Am I safe?

The CVE says the flaw needs the PDF Generator add-on and a form set up to make PDFs. If you are sure neither is the case, the flaw should not be usable on your site, but update anyway. (CVE record)

Where can I follow official updates?

The WordPress.org changelog and the Wordfence advisory. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Wordfence: Ultra Addons for Contact Form 7 <= 3.5.54: Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field, published November 2, 2026, checked November 3, 2026
CVE Program: CVE-2026-102435, published November 2, 2026 by Wordfence, checked November 3, 2026
OpenCVE: CVE-2026-102435, a mirror of the CVE record, checked November 3, 2026
NVD: CVE-2026-102435, status Deferred, checked November 3, 2026
Patchstack: Ultra Addons for Contact Form 7 <= 3.5.54, Arbitrary File Deletion, published November 2, 2026, checked November 3, 2026
WordPress.org: Ultra Addons for Contact Form 7 plugin page and changelog, version 3.5.57, 60,000+ active installations, checked November 3, 2026
CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 30, 2026, checked November 3, 2026